350-401 Question 253
Single answerA network administrator is tasked with securing a network by creating an Access Control List (ACL) to prevent unauthorized devices from accessing a critical server at IP address 192.168.1.10. The ACL should be applied inbound on the router's interface connected to the LAN. Which ACL configuration will effectively block access to the server while allowing all other traffic?
- A
deny ip any 192.168.1.10 log
- B
deny ip any 192.168.1.10 0.0.0.0 log
- C
permit ip any any
- D
deny ip 192.168.1.10 any log
- E
deny ip 192.168.1.10 0.0.0.0 any log
Show answer and explanation
Correct answer: B
Explanation
To block access to a specific server, you must use an ACL rule that denies traffic destined for the server's IP address while specifying a wildcard mask to match the exact IP. The correct syntax is 'deny ip any 192.168.1.10 0.0.0.0 log', where 'any' represents any source. The wildcard mask 0.0.0.0 ensures the rule applies only to the exact IP address 192.168.1.10. The 'log' keyword is optional but useful for troubleshooting. A permit rule is required after the deny statement to allow other traffic, but it is not explicitly shown in this scenario as the focus is on the deny rule.
- A. Incorrect.
This option is incorrect because it blocks all traffic to the server (192.168.1.10), but it lacks a wildcard mask, which makes it invalid in an ACL configuration.
- B. Correct.
This is the correct option. The ACL entry 'deny ip any 192.168.1.10 0.0.0.0 log' explicitly denies traffic to the exact IP address 192.168.1.10 using a wildcard mask of 0.0.0.0 (indicating a single host). The 'log' keyword is used to log any matches, enhancing monitoring capabilities.
- C. Incorrect.
This option permits all traffic, which does not align with the requirement to block access to 192.168.1.10.
- D. Incorrect.
This option is incorrect because it denies traffic originating from the server (192.168.1.10), but the task is to block traffic destined for the server.
- E. Incorrect.
This option is incorrect because it denies traffic originating from the server (192.168.1.10) with a wildcard mask of 0.0.0.0, which is not relevant to the scenario where the destination is being blocked.